An admin receives an e-mail from that payment service saying that the payment has been received.

That admin uses a feature to be added to the portal, which matches a PayPal/Google Checkout e-mail address with an application.

That admin uses the portal to create the user.

The portal does as much as it can within its own database.

It also prints a single command-line something like this to be run on deleuze:

magic-create-user-wrapper $USERNAME $REALNAME $EMAIL

These all come from the application database. $EMAIL is optional. If present, it should be used to initialize the new member's ~/.forward file. The new user's password should be read from deleuze:/var/lib/portal/$USERNAME, and that file should be deleted after the account is created.